Poetry-Driven PoeLLM Malware Hit More Than 3,400 Exposed Servers, Lumen Says

Lumen Technologies' Black Lotus Labs reported that the PoeLLM malware campaign, tracked as Canto Incognito, has compromised more than 3,400 internet-exposed servers since April, with peak activity exceeding 800 active infected systems in a single day. The campaign targeted internet-facing LiteLLM and Ollama deployments, along with Gotenberg and Gitea, using a crafted request against LiteLLM's /mcp-rest/test/connection endpoint as a likely exploitation path tied to CVE-2026-42271, and installed cryptocurrency miners including XMRig and Iron. PoeLLM retrieved its command-and-control address from four words in a poem stored in a GitHub repository that the operator changed 11 times, and Black Lotus Labs identified 12 associated C2 addresses, three of which remained active when its October 7 report was published.

Poetry-Driven PoeLLM Malware Hit More Than 3,400 Exposed Servers, Lumen Says - Lumen says PoeLLM compromised more than 3,400 servers, with peak activity above 800 active systems in a day. <sup \ 1\ https://www.lumen.com/blog/en-us/canto-incognito-tracking-the-poellm-malware </sup - The campaign targeted internet-exposed LiteLLM and Ollama deployments, while also affecting Gotenberg and Gitea. <sup \ 1\ https://www.lumen.com/blog/en-us/canto-incognito-tracking-the-poellm-malware </sup - Defenders should review Black Lotus Labs’ indicators, remove unnecessary public exposure and patch vulnerable LiteLLM installations. <sup \ 1\ https://www.lumen.com/blog/en-us/canto-incognito-tracking-the-poellm-malware </sup <sup \ 2\ https://github.com/advisories/GHSA-v4p8-mg3p-g94g </sup A malware campaign targeting exposed AI infrastructure has compromised more than 3,400 servers since April, according to Lumen Technologies’ Black Lotus Labs. The victims were concentrated in the United States and Western Europe, and many appeared to run internet-facing LiteLLM or Ollama services. \ 1\ https://www.lumen.com/blog/en-us/canto-incognito-tracking-the-poellm-malware Black Lotus Labs named the malware PoeLLM and the campaign Canto Incognito. The malware installs cryptocurrency miners, including XMRig and Iron, and reuses compromised servers to scan for and exploit additional targets. Lumen said peak activity exceeded 800 active infected servers in a day. \ 1\ https://www.lumen.com/blog/en-us/canto-incognito-tracking-the-poellm-malware How the campaign spread The campaign scanned exposed services and used a crafted request against LiteLLM’s /mcp-rest/test/connection endpoint as a likely exploitation path tied to CVE-2026-42271. Lumen identified LiteLLM instances listening on port 4000 and Gotenberg instances on port 3000; it did not identify a separate Ollama vulnerability in the published research, only exposed and vulnerable deployments among the victims. \ 1\ https://www.lumen.com/blog/en-us/canto-incognito-tracking-the-poellm-malware PoeLLM retrieved its command-and-control address from four words in a poem stored in a GitHub repository. The operator changed the poem 11 times, allowing infected systems to calculate new C2 addresses without changing the malware binary. Black Lotus Labs identified 12 associated C2 addresses and said three remained active when its October 7 report was published. \ 1\ https://www.lumen.com/blog/en-us/canto-incognito-tracking-the-poellm-malware \ 3\ https://github.com/blacklotuslabs/IOCs/blob/main/PoeLLM IOCs.txt Lumen recommends checking network logs against its published indicators, auditing externally reachable AI services and limiting access to required ports. Organizations using LiteLLM should also review the project’s advisory for CVE-2026-42271 and update affected deployments. \ 1\ https://www.lumen.com/blog/en-us/canto-incognito-tracking-the-poellm-malware \ 2\ https://github.com/advisories/GHSA-v4p8-mg3p-g94g Further sources The stories that matter, in one email. Free — unsubscribe anytime.